OPNsense Guard runs on your own machine — the client starts it, so there is no endpoint to ping. 174 installs a week from pypi. Last commit 27 Oct 2026.
Safety-first OPNsense firewall MCP: read-only by default, planned and auto-reverting writes.
What the code does
We read the source, 5 d ago · rules 995398eba69f
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
query = _SELECT + sql
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
This code can reach further than it looks
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add opnsense-guard-mcp -e 'OPNSENSE_URL=<OPNSENSE_URL>' -e 'OPNSENSE_API_KEY=<OPNSENSE_API_KEY>' -e 'OPNSENSE_API_SECRET=<OPNSENSE_API_SECRET>' -- uvx opnsense-guard-mcp{
"mcpServers": {
"opnsense-guard-mcp": {
"command": "uvx",
"args": [
"opnsense-guard-mcp"
],
"env": {
"OPNSENSE_API_KEY": "<OPNSENSE_API_KEY>",
"OPNSENSE_API_SECRET": "<OPNSENSE_API_SECRET>",
"OPNSENSE_URL": "<OPNSENSE_URL>"
}
}
}
}[mcp_servers.opnsense-guard-mcp]
command = "uvx"
args = ["opnsense-guard-mcp"]
env = { OPNSENSE_URL = "<OPNSENSE_URL>", OPNSENSE_API_KEY = "<OPNSENSE_API_KEY>", OPNSENSE_API_SECRET = "<OPNSENSE_API_SECRET>" }{
"mcpServers": {
"opnsense-guard-mcp": {
"command": "uvx",
"args": [
"opnsense-guard-mcp"
],
"env": {
"OPNSENSE_API_KEY": "<OPNSENSE_API_KEY>",
"OPNSENSE_API_SECRET": "<OPNSENSE_API_SECRET>",
"OPNSENSE_URL": "<OPNSENSE_URL>"
}
}
}
}{
"servers": {
"opnsense-guard-mcp": {
"type": "stdio",
"command": "uvx",
"args": [
"opnsense-guard-mcp"
],
"env": {
"OPNSENSE_API_KEY": "<OPNSENSE_API_KEY>",
"OPNSENSE_API_SECRET": "<OPNSENSE_API_SECRET>",
"OPNSENSE_URL": "<OPNSENSE_URL>"
}
}
}
}Put your own values in place of
<OPNSENSE_URL> (Firewall base URL, e.g. https://firewall.example.internal), <OPNSENSE_API_KEY> (API key of a least-privilege read user), <OPNSENSE_API_SECRET> (API secret of the read user).
The author’s registry entry marks them as required.
Optional settings from the registry entry, left out of the block above:
OPNSENSE_CA_BUNDLE (CA file for a self-signed firewall certificate).
Alternatives to OPNsense Guard
same job, measured the same wayMCP server for PostgreSQL. Read-only by default, row caps, timeouts, secrets never logged.
MCP server for MariaDB. Read-only by default, row caps, timeouts, secrets never logged.
macOS OpenVPN/FortiGate VPN status, logs and diagnosis; read-only by default, never returns secrets
Telegram MCP server: each AI client gets its own key, scoped to chosen chats. Read-only by default.
MCP server for MySQL. Read-only by default, row caps, statement timeouts, secrets never logged.
Read-only codebase audits for coding agents: secrets, RLS, deps, review verdicts. No writes.
Read-only XRP Ledger token-risk, issuer-authenticity and wallet-security checks.
Security-first MCP server for reverse engineering, malware analysis, forensics, and SAST.
OPNsense Guard — questions
Answers built from our own checks of this server.